feat(pg_upgrade): use self-hosted nix installer if available; move files out of /tmp (#1191)

Author: pcnc

ansible/files/admin_api_scripts/pg_upgrade_scripts/complete.sh

@@ -170,11 +170,13 @@ function apply_auth_scheme_updates {
 
 function start_vacuum_analyze {
     echo "complete" > /tmp/pg-upgrade-status
-    if ! command -v nix &> /dev/null; then
-        su -c 'vacuumdb --all --analyze-in-stages' -s "$SHELL" postgres
-    else
-        su -c '. /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && vacuumdb --all --analyze-in-stages' -s "$SHELL" postgres
+
+    # shellcheck disable=SC1091
+    if [ -f "/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh" ]; then
+        # shellcheck disable=SC1091
+        source "/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh"
     fi
+    vacuumdb --all --analyze-in-stages -U supabase_admin -h localhost -p 5432
     echo "Upgrade job completed"
 }
 

ansible/files/admin_api_scripts/pg_upgrade_scripts/initiate.sh

@@ -49,6 +49,8 @@ PGBINOLD="/usr/lib/postgresql/bin"
 PGLIBOLD="/usr/lib/postgresql/lib"
 
 PG_UPGRADE_BIN_DIR="/tmp/pg_upgrade_bin/$PGVERSION"
+NIX_INSTALLER_PATH="/tmp/persistent/nix-installer"
+NIX_INSTALLER_PACKAGE_PATH="$NIX_INSTALLER_PATH.tar.gz"
 
 if [ -L "$PGBINOLD/pg_upgrade" ]; then
     BINARY_PATH=$(readlink -f "$PGBINOLD/pg_upgrade")
@@ -286,9 +288,18 @@ function initiate_upgrade {
                 if ! command -v nix > /dev/null; then
                     echo "1.1. Nix is not installed; installing."
 
-                    curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix | sh -s -- install --no-confirm \
-                    --extra-conf "substituters = https://cache.nixos.org https://nix-postgres-artifacts.s3.amazonaws.com" \
-                    --extra-conf "trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=% cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+                    if [ -f "$NIX_INSTALLER_PACKAGE_PATH" ]; then
+                        echo "1.1.1. Installing Nix using the provided installer"
+                        tar -xzf "$NIX_INSTALLER_PACKAGE_PATH" -C /tmp/persistent/
+                        chmod +x "$NIX_INSTALLER_PATH"
+                        "$NIX_INSTALLER_PATH" install --no-confirm
+                    else
+                        echo "1.1.1. Installing Nix using the official installer"
+
+                        curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix | sh -s -- install --no-confirm \
+                        --extra-conf "substituters = https://cache.nixos.org https://nix-postgres-artifacts.s3.amazonaws.com" \
+                        --extra-conf "trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=% cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+                    fi
                 else 
                     echo "1.1. Nix is installed; moving on."
                 fi